feat(zoe): revoke used-up payments #8982
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erights
force-pushed
the
markm-move-revocability-to-base-zone-2
branch
from
8bcd3b0
to
f9fc35b
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
26d1ad4
to
db99ac8
Compare
erights
force-pushed
the
markm-move-revocability-to-base-zone-2
branch
from
f9fc35b
to
7a3e2c5
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
db99ac8
to
4f749e3
Compare
erights
force-pushed
the
markm-move-revocability-to-base-zone-2
branch
from
7a3e2c5
to
ade6ec9
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
4f749e3
to
782cac8
Compare
erights
force-pushed
the
markm-move-revocability-to-base-zone-2
branch
from
ade6ec9
to
774a52e
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
782cac8
to
e70e068
Compare
erights
force-pushed
the
markm-move-revocability-to-base-zone-2
branch
from
774a52e
to
fba5993
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
e70e068
to
dd87509
Compare
erights
force-pushed
the
markm-move-revocability-to-base-zone-2
branch
2 times, most recently
from
99fce04
to
4bf8835
Compare
Base automatically changed from
markm-move-revocability-to-base-zone-2
to
master
March 29, 2024 17:11
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
dd87509
to
5ce33fb
Compare
erights
commented
Mar 30, 2024
| @@ -901,7 +901,7 @@ test('lib-wallet offer methods', async t => { | |||
| description: 'getRefund', | |||
| handle: { | |||
| kind: 'unnamed', | |||
| petname: 'unnamed-7', | |||
| petname: 'unnamed-6', | |||
There was a problem hiding this comment.
This change made blindly. Reviewers, how should I figure out whether I should worry about this change?
erights
commented
Mar 30, 2024
| @@ -914,7 +914,7 @@ test('lib-wallet offer methods', async t => { | |||
| }, | |||
| inviteHandleBoardId: 'board0257', | |||
| meta: { | |||
| id: 9, | |||
| id: 8, | |||
There was a problem hiding this comment.
This change made blindly. Reviewers, how should I figure out whether I should worry about this change?
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
0a7af31
to
9ec6de5
Compare
10 tasks
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
9ec6de5
to
a70707f
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
a70707f
to
721cc3e
Compare
Deploying agoric-sdk with
|
| Latest commit: |
f2f2f3b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://818c1b93.agoric-sdk.pages.dev |
| Branch Preview URL: | https://markm-revoke-used-up-payment.agoric-sdk.pages.dev |
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
721cc3e
to
81a7370
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
5bbeb1e
to
f883dcc
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
2 times, most recently
from
49d7ec1
to
9d259f8
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
9d259f8
to
2d616e0
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
2d616e0
to
121d928
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
121d928
to
e53274d
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
e53274d
to
8723afa
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
3 times, most recently
from
8fcdbbc
to
3da98ca
Compare
erights
force-pushed
the
markm-revoke-used-up-payments-3
branch
from
3da98ca
to
f2f2f3b
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
closes: #XXXX
refs: #XXXX
Description
Prior to this PR, a used up payment was still a live exo object, even with one method that continued to work --
getAllegedBrand(). This PR wraps it with a revocable caretaker, and only exposes the caretaker as the payment. When the payment is used up, it is also revoked.This PR is in theory not compat with code prior to this PR because
getAllegedBrand()on a used up payment will no longer work. However, we have not seen that failure in practice.Security Considerations
Since used up payments were already reliably powerless, the additional protection of a general revocation mechanism probably has no effect on actual security.
Scaling Considerations
This PR has a bit of a cost -- twice as many payment-ish objects, the underlying original payment and the new caretaker. However, by marking the exposed object as revoked, we hope eventually to make use of this known dead state to drop bookkeeping elsewhere. But we do not yet have a plausible story for doing so, in which case this PR imposes this code with no compensating performance benefit.
Documentation Considerations
Only that
getAllegedBrand()stops working. Otherwise this PR should have no externally visible effects.Testing Considerations
Because the revocable payment has a different "alleged" label, we had to fix some golden tests.
Upgrade Considerations
Payments already created prior to this PR will remain the underlying non-revocable payment. Only payments created after this PR will be revocable. However, the only observable anomaly is that
getAllegedBrand()on those old payments will continue to work after they have been used up.